6.3med
CVE-2017-96401 exploit
A Path Traversal issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web prior to 6.5; ALC WebCTRL, SiteS…
Published 9 y ago · modified 4 mo ago · JSON
CVSS
6.3
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
8.5%
percentile 95%
Public exploits
1
Exploit-DB
Summary
A Path Traversal issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web prior to 6.5; ALC WebCTRL, SiteScan Web 6.1 and prior; ALC WebCTRL, i-Vu 6.0 and prior; ALC WebCTRL, i-Vu, SiteScan Web 5.5 and prior; and ALC WebCTRL, i-Vu, SiteScan Web 5.2 and prior. An authenticated attacker may be able to overwrite files that are used to execute code. This vulnerability does not affect version 6.5 of the software.
Exploit prediction (EPSS)
8.45% probability of exploitation in the next 30 days, higher than 95% of all scored CVEs.
Exploits and detections
- EDB-42543 Automated Logic WebCTRL 6.1 - Path Traversal / Arbitrary File Write · webapps · 2017-08-22
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 6.3 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Affected products
- n/a Automated Logic Corporation WebCTRL, i-VU, SiteScan
Classification
- Weakness
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
- securityfocus.com /bid/100452 · vdb-entry, x_refsource_BID, x_transferred
- exploit-db.com /exploits/42543/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
- ics-cert.us-cert.gov /advisories/ICSA-17-234-01 · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2017-9640
- NVD: CVE-2017-9640
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.